Zebrocy used heavily by the Sednit group over last two years

ESET describes the Zebrocy malware family used by the Sednit (APT28/Fancy Bear) group: a multi-stage intrusion chain (Delphi downloader, AutoIt downloader, Delphi backdoor) delivered via malicious Office documents and archives that performs extensive reconnaissance and data collection and is used to deploy the Xagent backdoor on high-value targets (diplomats, embassies, ministries). The report documents evolving backdoor versions, TTPs, commands/capabilities, persistence mechanisms, and provides numerous IoCs (file hashes and C2 URLs) for detection and monitoring.